What you need to know today.
Barracuda ESG flaws are actively exploited, while critical vulnerabilities in Adobe Connect and Experience Manager pose significant risks.
Barracuda Networks has disclosed a critical authentication bypass vulnerability (CVE-2026-116606) in its Email Security Gateway. Versions prior to 9.4.0.030 are affected. Attackers can exploit this flaw to import a crafted backup archive, potentially leading to remote code execution and root access. This vulnerability has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation. Several security researchers and news outlets, including SecurityWeek and The Hacker News, have reported on this issue, highlighting the severity and the potential for attackers to gain complete control over the affected systems.
A significant number of critical vulnerabilities have been disclosed in Adobe Connect, with multiple CVEs including CVE-2026-121889, CVE-2026-121356, CVE-2026-121908, CVE-2026-121898, CVE-2026-121896, and CVE-2026-121894, all related to Server-Side Request Forgery (SSRF) and SQL Injection. These flaws could allow remote attackers to escalate privileges or achieve arbitrary code execution. Additionally, other Adobe Connect vulnerabilities such as CRLF Injection (CVE-2026-121353), Incorrect Authorization (CVE-2026-121352), and Path Traversal (CVE-2026-121351, CVE-2026-121906, CVE-2026-121354) further compound the risk, potentially enabling unauthorized access to sensitive files and resources.
Multiple critical vulnerabilities have been identified in Adobe Experience Manager, including Incorrect Authorization (CVE-2026-119017, CVE-2026-114371) and Code Injection (CVE-2026-113580, CVE-2026-113579). These flaws could permit low-privileged attackers to execute arbitrary code within the context of the current user, leading to elevated access and control over the affected systems. The widespread nature of these vulnerabilities across different Adobe products underscores the need for prompt patching and security diligence.
WordPress sites utilizing the Staggs STAGGS plugin are vulnerable to a critical Code Injection flaw (CVE-2026-78287) up to version 3.3.0. This vulnerability allows remote attackers to achieve code inclusion, posing a significant risk to website integrity and security. While specific exploitation details are limited, such vulnerabilities can often be leveraged for further compromise, including data theft or malware distribution.
Coderider-Kilo